chapter 4 panko and panko business data networks and security, 10 th edition, global edition...
TRANSCRIPT
Network and Security Management
Chapter 4
Panko and PankoBusiness Data Networks and Security, 10th Edition, Global EditionCopyright © 2015 Pearson Education, Ltd.
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
Security is a Process, not a Product
Fazio Engineering Services◦ Contractor with weak security
◦ Fell for spear phishing attack, giving access to the vendor server
◦ Fazio used a free antivirus program not meant for corporations Did not warn for individual messages
Failures in the Target Breach
Copyright © 2015 Pearson Education, Ltd.
Was Able to Move to Sensitive Servers◦ Should not have been able to
Ignored Explicit Warnings◦ Priority warning from the FireEye IDS service
◦ November 30, December 1, December 3
◦ Exfiltration began on December 2
◦ If had stopped the attack then, damage would have been minimal or nonexistent
Failures in the Target Breach
Copyright © 2015 Pearson Education, Ltd.
For a weapon to succeed, a number of steps must go correctly
This is called the kill chain
Security attacks also have kill chains
Companies must look for evidence of kill chain patters and end the chain before the end
Target did not
Kill Chain Analysis
Copyright © 2015 Pearson Education, Ltd.
Kill Chain
Figure 3.1
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
4.1 Network Demand and Budgets
User demand is growing much faster than network budgets.
Cost efficiency is always critical.
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
4.2 Quality-of-Service (QoS) Metrics
1 ms = 0.001 sec
Copyright © 2015 Pearson Education, Ltd.
Rated Speed◦ The speed a system should achieve
◦ According to vendor claims or to the standard that defines the technology
Throughput◦ The data transmission speed a system actually
provides to users
4.3 Rated Speed, Throughput, Aggregate Throughput, and Individual Throughput
Copyright © 2015 Pearson Education, Ltd.
Aggregate versus Rated Throughput on Shared Lines◦ The aggregate throughput is the total throughput
available to all users in part of a network
Individual Throughput◦ The individual throughput is an individual’s share
of the aggregate throughput
4.3 Rated Speed, Throughput, Aggregate Throughput, and Individual Throughput
Copyright © 2015 Pearson Education, Ltd.
4.3 Rated Speed, Throughput, Aggregate Throughput, and Individual Throughput
Individual throughput
Aggregate throughput
Rated speed
Copyright © 2015 Pearson Education, Ltd.
You are in a Wi-Fi hot spot with 20 other
people. The access point router is rated as
following the 802.11ac standard with
options providing 300 Mbps. Throughput is
about 50%. At a certain moment, you and
four others are sending and receiving. What
individual throughput are you likely to
receive?
Speed Knowledge Check
Copyright © 2015 Pearson Education, Ltd.
CNET News: Steve Jobs' demo failhttps://www.youtube.com/watch?v=znxQOPFg2mo
Copyright © 2015 Pearson Education, Ltd.
4.4 Jitter
Jitter is variability in latencyMakes voice and video seem “jittery”Engineering networks to reduce jitter can be expensive
Copyright © 2015 Pearson Education, Ltd.
Service Level Agreements (SLAs)◦ Guarantees for performance
◦ Penalties if the network does not meet its service metrics guarantees
4.5 Service Level Agreements (SLAs)
Copyright © 2015 Pearson Education, Ltd.
Guarantees specify worst cases (no worse than)◦ Lowest speed (e.g., no worse than 1 Mbps)
◦ Maximum latency (e.g., no more than 125 ms)
◦ SLAs are like insurance policies
4.5 Service Level Agreements (SLAs)
Copyright © 2015 Pearson Education, Ltd.
Often written on a percentage basis◦ No worse than 100 Mbps 99.5% of the time
◦ Because as the percentage increases, additional engineering raises network costs
◦ 100% compliance would be prohibitively expensive
4.5 Service Level Agreements (SLAs)
Copyright © 2015 Pearson Education, Ltd.
Residential services are rarely sold with SLA guarantees◦ It would be expensive to engineer the network for
high-percentage guarantees for residential customers
◦ This would make prices unacceptable
◦ Businesses require high-percentage guarantees and so are willing to pay higher prices
4.5 Service Level Agreements (SLAs)
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
4.6 Two-Site Traffic Analysis
Network design is based on speed requirements
These may be different in the two directions
Most transmission lines are symmetric in speed
In such cases, the higher-speed dictates line
speed
Copyright © 2015 Pearson Education, Ltd.
4.7 Three-Site Traffic Analysis
There are three sites connected by two links
Copyright © 2015 Pearson Education, Ltd.
4.7 Three-Site Traffic Analysis
Link QR must carry the traffic flowing between Q and Rand the traffic flowing between R and S
Copyright © 2015 Pearson Education, Ltd.
4.7 Three-Site Traffic Analysis
Copyright © 2015 Pearson Education, Ltd.
4.7 Three-Site Traffic Analysis
Copyright © 2015 Pearson Education, Ltd.
4.8 Three-Site Traffic Analysis with Redundancy
Each pair of sites is connectedLines only carry traffic between site pairs
Copyright © 2015 Pearson Education, Ltd.
4.8 Three-Site Traffic Analysis with Redundancy
How can traffic get from Q to R?
Copyright © 2015 Pearson Education, Ltd.
4.9 Addressing Momentary Traffic Peaks Normally, network capacity is higher than the
traffic.
Sometimes, however, there will be momentary traffic peaks above the network’s capacity—usually for a fraction of a second to a few seconds.
Copyright © 2015 Pearson Education, Ltd.
4.9 Addressing Momentary Traffic Peaks Congestion causes latency because switches and
routers must store frames and packets while waiting to send them out again.
Buffers are limited, so some packets may be lost.
Copyright © 2015 Pearson Education, Ltd.
4.9 Addressing Momentary Traffic Peaks Overprovisioning is providing far more capacity
than the network normally needs.
This avoids nearly all momentary traffic peaks wasteful of transmission line capacity.
Copyright © 2015 Pearson Education, Ltd.
4.9 Addressing Momentary Traffic Peaks With priority, latency-intolerant traffic, such as
voice, is given high priority and will go first.
Latency-tolerant traffic, such as e-mail, must wait.
More efficient than overprovisioning; also more labor-intensive.
Copyright © 2015 Pearson Education, Ltd.
4.9 Addressing Momentary Traffic Peaks QoS guarantees reserved capacity for some
traffic, so this traffic always gets through.
Other traffic, however, must fight for the remaining capacity.
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
4.10 Threat Environment
You cannot defend yourself unless you know the threat environment you face.
Copyright © 2015 Pearson Education, Ltd.
4.10 Plan-Protect-Respond
Companies defend themselves with a process called the Plan-Protect-Respond
Cycle.
Copyright © 2015 Pearson Education, Ltd.
4.10 Planning
The Plan-Protect-Respond Cycle starts with Planning.
We will look at important planning principles.
Copyright © 2015 Pearson Education, Ltd.
4.10 Protecting
Companies spend most of their security effort onthe protection phase, in which they apply
planned protections on a daily basis.We covered this phase in Chapter 3.
Copyright © 2015 Pearson Education, Ltd.
4.10 Response
Even with great planning and protection, incidentswill happen, and a company must have a well-rehearsed
plan for responding to them.
Copyright © 2015 Pearson Education, Ltd.
Security Is a Management Issue, Not a Technology Issue◦ Without good management, technology cannot be
effective
◦ A company must have good security processes
4.11 Security Planning Principles
Copyright © 2015 Pearson Education, Ltd.
Security Planning Principles◦ Risk analysis
◦ Comprehensive security
◦ Defense in depth
◦ Weakest link analysis
◦ Single points of takeover
◦ Least permissions in access control
4.11 Security Planning Principles
Copyright © 2015 Pearson Education, Ltd.
The goal is not to eliminate all risk
You would not pay a million dollars for a countermeasure to protect an asset costing ten dollars
You should reduce risk to the degree that it is economically reasonable
You must compare countermeasure benefits with countermeasure costs
4.11 Risk Analysis
Copyright © 2015 Pearson Education, Ltd.
4.12: Risk Analysis CalculationCountermeasure None A
Damage per successful attack $1,000,000
$500,000
Annual probability of a successful attack
20% 20%
Annual probability of damage $200,000 $100,000
Annual cost of countermeasure $0 $20,000
Net annual probable outlay $200,000 $120,000
Annual value of countermeasure $80,000
Adopt the countermeasure? Yes
Countermeasure Acuts the damage per successful attack in half,but does not change the annual probability of
occurrence.
Copyright © 2015 Pearson Education, Ltd.
3.10 Risk Analysis CalculationCountermeasure None A
Damage per successful attack $1,000,000 $500,000
Annual probability of a successful attack
20% 20%
Annual probability of damage $200,000 $100,000
Annual cost of countermeasure $0 $20,000
Net annual probable outlay $200,000 $120,000
Annual value of countermeasure $80,000
Adopt the countermeasure? Yes
Countermeasure AWill have a net savings of $80,000 per
year.
Copyright © 2015 Pearson Education, Ltd.
3.10 Risk Analysis CalculationCountermeasure None B
Damage per successful attack $1,000,000 $1,000,000
Annual probability of a successful attack
20% 15%
Annual probability of damage $200,000 $150,000
Annual cost of countermeasure $0 $60,000
Net annual probable outlay $200,000 $210,000
Annual value of countermeasure -$10,000
Adopt the countermeasure? No
Countermeasure Bcuts the frequency of occurrence in half,
but does not change the damage per occurrence.
Copyright © 2015 Pearson Education, Ltd.
3.10 Risk Analysis CalculationCountermeasure None B
Damage per successful attack $1,000,000 $1,000,000
Annual probability of a successful attack
20% 15%
Annual probability of damage $200,000 $150,000
Annual cost of countermeasure $0 $60,000
Net annual probable outlay $200,000 $210,000
Annual value of countermeasure -$10,000
Adopt the countermeasure? No
This time, the countermeasure is too expensive.
Copyright © 2015 Pearson Education, Ltd.
4.13 Comprehensive Security
Copyright © 2015 Pearson Education, Ltd.
4.14 Defense in Depth
Copyright © 2015 Pearson Education, Ltd.
4.15 Identifying Weakest Links
Copyright © 2015 Pearson Education, Ltd.
Defense in Depth
Weakest Link
Countermeasures Several One
CriterionOne must succeed
All components
must succeed
Weakest Link versus Defense in Depth
Copyright © 2015 Pearson Education, Ltd.
4.16 Protecting Single Points of Take-Over
Central control is crucial to reducing
labor costs and implementation speed
Copyright © 2015 Pearson Education, Ltd.
4.16 Protecting Single Points of Take-Over
Copyright © 2015 Pearson Education, Ltd.
Access Control◦ If attackers cannot get access to a resource, they
cannot exploit it
◦ Access control is limiting who may have access to each resource
◦ And limiting his or her permissions when using the resource
4.17 Least Permissions in Access Control
Copyright © 2015 Pearson Education, Ltd.
Authentication versus Authorizations (Permissions)◦ Authentication: Proof of identity
◦ Authorizations: Permissions a particular authorized user is given with a resource
◦ Just because a user is authenticated does not mean that he or she will be permitted to do everything
4.17 Least Permissions in Access Control
Copyright © 2015 Pearson Education, Ltd.
Principle of Least Permissions◦ Give each authenticated user only the minimum
permissions he or she needs to do his or her job
◦ Cannot do unauthorized things that will compromise security
4.17 Least Permissions in Access Control
Copyright © 2015 Pearson Education, Ltd.
Examples of Limited Permissions◦ Create files but not delete files
◦ Cannot see files above a certain level of sensitivity
◦ Read files but not write (edit) them
◦ See files in own folders but not all folders
◦ Connect to the person’s department server but not to the Finance server
◦ Do certain things but cannot give others permission to do them
4.17 Least Permissions in Access Control
Copyright © 2015 Pearson Education, Ltd.
4.18 Policy-Based Security
Planners create policies, which specify what to do but
not how to do it.
Policy-makers create policies with global knowledge.
Implementers implement policies with local and technical expertise.
Copyright © 2015 Pearson Education, Ltd.
Policy Example◦ Use strong encryption for credit cards.
Implementation of the Policy◦ Choose a specific encryption method within this
policy.
◦ Select where in the process to do the encryption.
◦ Choose good options for the encryption method.
4.18 Policy-Based Security
Copyright © 2015 Pearson Education, Ltd.
4.18 Policy-Based Security
Implementation guidance goes beyond
pure “what” by constraining to some
extent the “how”.
For example, it may specify that encryption
keys must be more than 100 bits long.
Constrains implementers so they will make
reasonable choices.
Copyright © 2015 Pearson Education, Ltd.
4.18 Policy-Based Security
Implementation Guidance has two forms.
Standards MUST be followed by implementers.
Guidelines SHOULD be followed, but are optional.However, guidelines must be considered carefully.
Copyright © 2015 Pearson Education, Ltd.
4.18 Policy-Based Security
Oversight checks that policies are being implemented successfully.
Good implementation +Good oversight =Good protection
Copyright © 2015 Pearson Education, Ltd.
4.18 Policy-Based Security
Policies are given to implementers and oversight staff independently.
Oversight may uncover implementation problems or
problems with the specification of the policy.
Copyright © 2015 Pearson Education, Ltd.
Failure in the Target Breach
Cost Matters
Network Quality of Service QoS
Network Design
Security Planning Principles
Centralized Management
Copyright © 2015 Pearson Education, Ltd.
4.19 Ping
It is desirable to have network visibility—to know the status of all devices at all times.
Ping can determine if a host or router is reachable.
The simple network management protocol (SNMP) is designed to collect extensive information needed for network visibility.
Copyright © 2015 Pearson Education, Ltd.
4.20: Simple Network Management Protocol (SNMP)
Central manager program communicates with each managed device.
Actually, the manager communicates with a network management agent on each device.
Copyright © 2015 Pearson Education, Ltd.
4.20: SNMP
The manager sends SNMP commands and gets SNMP responses.
Agents can send SNMP traps (alarms) if there are problems.
Copyright © 2015 Pearson Education, Ltd.
4.20: SNMP
Information from agents is stored in the SNMP management information base.
Copyright © 2015 Pearson Education, Ltd.
4.20: SNMP
MIB
Management Information Base
Copyright © 2015 Pearson Education, Ltd.
http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf014.pdf
Configuring SNMP Support
Network visualization programs analyze information from the MIB to portray the network, do troubleshooting, and answer specific questions.
Copyright © 2015 Pearson Education, Ltd.
4.20: SNMP
SNMP interactions are standardized, but network visualization program functionality is not, in order not to constrain developers of visualization tools.
Copyright © 2015 Pearson Education, Ltd.
4.20: SNMP
Copyright © 2015 Pearson Education, Ltd.
4.21 Traditional Device Control in Networking
Firewall Forwarding◦ How the firewall deals with incoming packets
◦ What interface (port) to send them out
Firewall Control◦ Creates the rules for firewall forwarding
◦ In comparison, firewall forwarding is comparatively simple
Copyright © 2015 Pearson Education, Ltd.
4.21 Traditional Device Control in Networking
Copyright © 2015 Pearson Education, Ltd.
4.22 Software-Defined Networking (SDN) Control
Copyright © 2015 Pearson Education, Ltd.
4-23 Centralized Firewall Management
Copyright © 2015 Pearson Education, Ltd.
4-23 Centralized Firewall Management